Worse yet, why is that CA even part of the Root CAs shipped on all the modern devices?

My trust in those vetting the CAs is completely broken now.

It's not. The CA in question is an intermediate CA that somehow managed to convince a root to sign their public key.

	▲	denysvitali 6 hours ago \| parent \| next [-]
		They're a Root CA too, Sectigo should have done their job before blindly x-signing it though.
	▲	SAI_Peregrinus 5 hours ago \| parent \| prev [-]
		They were a root CA.